Yuki Takei 7 лет назад
Родитель
Сommit
c461a6112b
1 измененных файлов с 4 добавлено и 10 удалено
  1. 4 10
      lib/util/xss.js

+ 4 - 10
lib/util/xss.js

@@ -3,7 +3,6 @@ class Xss {
   constructor(xssOption) {
   constructor(xssOption) {
     const xss = require('xss');
     const xss = require('xss');
 
 
-    const isEnabledXssPrevention = xssOption.isEnabledXssPrevention;
     const tagWhiteList = xssOption.tagWhiteList;
     const tagWhiteList = xssOption.tagWhiteList;
     const attrWhiteList = xssOption.attrWhiteList;
     const attrWhiteList = xssOption.attrWhiteList;
 
 
@@ -12,20 +11,15 @@ class Xss {
     // default
     // default
     let option = {
     let option = {
       stripIgnoreTag: true,
       stripIgnoreTag: true,
-      stripIgnoreTagBody: false,
+      stripIgnoreTagBody: false,    // see https://github.com/weseek/growi/pull/505
       css: false,
       css: false,
       whiteList: whiteListContent,
       whiteList: whiteListContent,
       escapeHtml: (html) => html,   // resolve https://github.com/weseek/growi/issues/221
       escapeHtml: (html) => html,   // resolve https://github.com/weseek/growi/issues/221
     };
     };
 
 
-    if (isEnabledXssPrevention) {
-      tagWhiteList.forEach(tag => {
-        whiteListContent[tag] = attrWhiteList;
-      });
-    }
-    else {
-      option['stripIgnoreTag'] = false;
-    }
+    tagWhiteList.forEach(tag => {
+      whiteListContent[tag] = attrWhiteList;
+    });
 
 
     // create the XSS Filter instance
     // create the XSS Filter instance
     this.myxss = new xss.FilterXSS(option);
     this.myxss = new xss.FilterXSS(option);